Subject Access Request to Nottinghamshire Police

Nottinghamshire Police asks you to make the request on its online form, or to complete its downloadable form and post or email it. Both the form and the page that links it tell you to post it "to the address below" and then print no address at all — the postal address above comes from section 12 of the force's privacy notice, which is where it designates the Information Management Unit as the route for exercising your rights. The request is free, and our free letter template will draft a letter if you would rather write than fill in a form. If a search engine hands you a Nottinghamshire subject access form, check which one you have. An older form is still live on the force's site and its own site search still returns it. It is headed for the Data Protection Act 1998, gives the address as the Information Management Office rather than Unit, prints an email address on a police domain the force has stopped using, and says that "only the first copy of any disclosure is provided free of charge" and that later copies attract a fee. That fee was abolished in 2018 and the mailbox is obsolete. The current form is the one linked from the force's own subject access page, and the contact details above are the ones on this page. The force publishes a telephone number for exercising your rights and it needs an extension: 0115 9670999 extension 3180888, given in the same paragraph of its privacy notice as the email and postal addresses above. Dialling the number without the extension reaches an old switchboard the force no longer advertises — its current numbers all begin 0115 844 — so ask for the Information Management Unit if you get through to a general line. Body-worn video does not last long. The force's body-worn video policy says footage marked non-evidential is automatically deleted after 31 days, and that during those 31 days it can be found and marked as evidential. Automatic number plate recognition data is kept for a year, though most authorised staff can only reach it for 90 days from the date it was collected. If your incident was on a motorway or major A road the camera may not be the force's at all: National Highways keeps its footage for only seven days, and the force asks you to request that within five. The force's own pages give the deadline two different ways. Its subject access page and form say one calendar month, or three months for complex requests; its information rights page — which the subject access page itself links — says "We usually respond within 30 days. But it can take up to two months extra." Thirty days is not a calendar month, and the legal position is one month, extendable by two more. Sign the form by hand. The force says you will need to sign it physically rather than digitally, that your signature will be matched against the one on your identity documents, and that the request will be rejected if they do not match. It also sets recency rules its web page does not mention: a passport valid or expired within six months, a driving licence current or within three months, and a bank statement or utility bill issued within the last six months. The address you give cannot be a PO Box. A collision report is a separate route and, unlike most forces, this one is not open to you. The force says the service "is for solicitors and insurance companies acting on behalf of a client", and asks members of the public to email for more information instead. It charges a non-refundable £48.00 administration fee simply to search its databases, with the cost of the report itself on top, says it can take several months from the date it receives payment, and releases nothing until the case has closed. A subject access request for what the force holds about you is free. Several things go through a different door, and the force's form says so. Your national criminal record and a police certificate for a visa are ACRO; a check an employer has asked for is a DBS check, and requiring you to use subject access instead is an offence; an insurance claim is made by your insurer directly; and family court disclosure is not this route. A request to this force returns what it holds locally — incident reports, custody records, body-worn video, 999 and 101 recordings. Other forces are listed on the police subject access request page.

Made under Part 3 of the Data Protection Act 2018 (law enforcement processing), and UK GDPR Article 15 for non-policing purposes

A request to a police force is not a straightforward Article 15 request. Where a force is processing your data as a competent authority for law enforcement purposes, your right of access comes from section 45 of the Data Protection Act 2018 rather than the UK GDPR. The practical effect is similar — you are entitled to a copy of your personal data — but the restrictions available to the force are different and broader.

The same force may hold data about you under both regimes at once. Intelligence entries, custody records and incident logs sit under Part 3; an employment file, a firearms licence application or a complaint you made as a member of the public may sit under the UK GDPR. A single request can cover both, and the force should deal with each under the correct regime.

Police records sit in two places, and which one you want decides who you ask. Arrests, charges, cautions, convictions and firearms certificates are held nationally on the Police National Computer, and requests for that national record are handled centrally rather than by your local force. Everything a particular investigation generated stays with the force that dealt with it: custody records and custody photographs, body-worn video, 999 and 101 recordings, statements you or others gave, interview notes, and reports of incidents you reported. A national request will not return local material and a local request will not return the national record, so if you want both you make two requests. Scottish records sit on a separate national system again.

This is separate from a criminal record certificate, and which body issues one depends on where you are. In England and Wales it is the Disclosure and Barring Service, whose basic check guidance for applicants explains what you get; in Scotland it is Disclosure Scotland, whose Level 1 and Level 2 disclosures replaced basic, standard and enhanced disclosures on 1 April 2025 — mygov.scot sets out the levels; in Northern Ireland it is AccessNI, and nidirect lists the types of AccessNI check. ACRO issues police certificates for emigration and visa applications. None of these is a subject access request, and people routinely make one when they wanted a certificate instead, then lose months finding out.

• Incident and crime reports where you are named
• Custody records and detention logs
• Intelligence entries and markers held against you
• Body-worn video and 999 or 101 call recordings
• Records of stop and search encounters

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.